Behavior based authentication for touch screen devices

• US 9,589,120 B2
• Filed: 04/05/2013
• Issued: 03/07/2017
• Est. Priority Date: 04/05/2013
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Samuel, Arjmand, Shahzad, Muhammad
• Primary Examiner(s): Lee, Benjamin C
• Assistant Examiner(s): Zheng, Xuemei
• Application Number:
  US13/857,155
• Publication Number:
  US 20140300554A1
• Time in Patent Office: 1,432 Days
• Field of Search: 345/173
• US Class Current: 1/1
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 21/84 output devices, e.g. displays or monitors
• CPC Class Codes: G06F 2203/04104 Multi-touch detection in digitiser, i.e. details about the simultaneous detection of a plurality of touching locations, e.g. multiple fingers or pen and finger
• CPC Class Codes: G06F 2203/04808 Several contacts: gestures triggering a specific function, e.g. scrolling, zooming, right-click, when the user establishes several contacts with the surface simultaneously; e.g. using several fingers or a combination of fingers and pen
• CPC Class Codes: G06F 3/041 Digitisers, e.g. for touch screens or touch pads, characterised by the transducing means
• CPC Class Codes: G06F 3/04883 for inputting data by handwriting, e.g. gesture or text
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

A method, system, and one or more computer-readable storage media for behavior based authentication for touch screen devices are provided herein. The method includes acquiring a number of training samples corresponding to a first action performed on a touch screen of a touch screen device, wherein the first action includes an input of a signature or a gesture by a legitimate user. The method also includes generating a user behavior model based on the training samples and acquiring a test sample corresponding to a second action performed on the touch screen, wherein the second action includes an input of the signature or the gesture by a user. The method further includes classifying the test sample based on the user behavior model, wherein classifying the test sample includes determining whether the user is the legitimate user or an imposter.

Claims

1. A method for behavior based authentication for touch screen devices, comprising:

acquiring a plurality of training samples corresponding to a first action performed on a touch screen of a touch screen device, wherein the first action comprises an input of a gesture by a legitimate user;

generating a user behavior model based on the plurality of training samples, what features of the training samples by multiple users, and how features of the training samples by distinct users, wherein the what features comprise a displacement magnitude, and wherein the how features comprise the displacement magnitude;

acquiring a test sample corresponding to a second action performed on the touch screen, wherein the second action comprises an input of the gesture by a user; and

classifying the test sample based on the user behavior model, wherein classifying the test sample comprises determining whether the user is the legitimate user or an imposter, including by automatically adjusting a time resolution for each of a plurality of subparts of an input of the first action until and in order to obtain consistent feature values for the subparts for different locations of the first action.

2. The method of claim 1, wherein generating the user behavior model comprises:

extracting features corresponding to the first action from the plurality of training samples;

selecting a portion of the features that have consistent values for all of the plurality of training samples;

extracting behaviors corresponding to the portion of the features from the plurality of training samples;

partitioning the plurality of training samples into a plurality of training groups based on the behaviors corresponding to the portion of the features, wherein each of the plurality of training groups corresponds to one of the behaviors; and

generating a user behavior model for each of the plurality of training groups.

3. The method of claim 2, wherein generating the user behavior model for each of the plurality of training groups comprises training a support vector distribution estimation (SVDE) based classifier for each of the plurality of training groups.

4. The method of claim 2, wherein classifying the test sample comprises:

extracting the portion of the features that have consistent values for all of the plurality of training samples from the test sample;

extracting test behaviors corresponding to the portion of the features from the test sample; and

comparing the test behaviors extracted from the test sample to the behaviors corresponding to the plurality of training groups based on the user behavior models.

5. The method of claim 1, wherein the first action and the second action correspond to user authentication for the touch screen device, and wherein the method comprises:

if the user is the legitimate user, allowing the user to access the touch screen device; and

if the user is the imposter, denying the user access to the touch screen device.

6. The method of claim 1, wherein the first action and the second action correspond to user authentication for a credit card or a debit card.

7. The method of claim 1, comprising executing the method for each of a plurality of actions performed on the touch screen, wherein each of the plurality of actions comprises an input of a specified gesture.

8. The method of claim 7, comprising:

ranking the specified gestures corresponding to the plurality of actions based on an accuracy of the legitimate user in inputting a plurality of training samples for the plurality of actions; and

acquiring and classifying a test sample corresponding to each of the plurality of actions in a descending order based on the ranking of the specified gestures.

9. The method of claim 8, comprising determining that the user is the legitimate user if a majority of classifications for the test samples determine that the user is the legitimate user.

10. The method of claim 1, wherein the first action comprises an input of a specified gesture by one or more fingers of the legitimate user, and wherein the second action comprise an input of the specified gesture by one or more fingers of the user.

11. The method of claim 1, wherein the first action may be divided into subparts at a plurality of time resolutions.

12. A touch screen device, comprising:

a touch screen;

a processor that is adapted to execute stored instructions; and

a system memory, wherein the system memory comprises code configured to;

acquire a plurality of training samples corresponding to a first action performed on the touch screen, wherein the first action comprises an input of a signature by a legitimate user;

generate a user behavior model based on the plurality of training samples, what features of the training samples by multiple users, and how features of the training samples by distinct users, wherein the what features comprise a displacement magnitude, and wherein the how features comprise the displacement magnitude;

acquire a test sample corresponding to a second action performed on the touch screen, wherein the second action comprises an input of the signature by a user; and

classify the test sample based on the user behavior model, wherein classifying the test sample comprises determining whether the user is the legitimate user or an imposter, including by automatically adjusting a time resolution for each of a plurality of subparts of an input of the first action until and in order to obtain consistent feature values for the subparts for different locations of the first action.

13. The touch screen device of claim 12, wherein the system memory comprises code configured to:

extract features corresponding to the first action from the plurality of training samples;

select a portion of the features that have consistent values for all of the plurality of training samples;

extract behaviors corresponding to the portion of the features from the plurality of training samples;

partition the plurality of training samples into a plurality of training groups based on the behaviors corresponding to the portion of the features, wherein each of the plurality of training groups corresponds to one of the behaviors; and

generate a user behavior model for each of the plurality of training groups.

14. The touch screen device of claim 13, wherein the system memory comprises code configured to generate the user behavior model for each of the plurality of training groups by training a support vector distribution estimation (SVDE) based classifier for each of the plurality of training groups.

15. The touch screen device of claim 13, wherein the system memory comprises code configured to:

extract the portion of the features that have consistent values for all of the plurality of training samples from the test sample;

extract test behaviors corresponding to the portion of the features from the test sample; and

classify the test sample by comparing the test behaviors extracted from the test sample to the behaviors corresponding to the plurality of training groups based on the user behavior models.

16. The touch screen device of claim 12, wherein the first action and the second action correspond to user authentication for the touch screen device, and wherein the system memory comprises code configured to:

if the user is the legitimate user, allow the user to access the touch screen device; and

if the user is the imposter, deny the user access to the touch screen device.

17. The touch screen device of claim 12, wherein the first action comprises an input of a specified gesture by one or more fingers of the legitimate user, and wherein the second action comprise an input of the specified gesture by one or more fingers of the user.

18. The touch screen device of claim 12, wherein the first action comprises an input of a signature by the legitimate user via a touch input device, and wherein the second action comprise an input of the signature by the user via the touch input device.